NetGear R系列多款路由器远程命令注入漏洞分析

if ( v31 )
{
fclose(v31);
system((const char *)&unk_F05D8);
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
puts("\r\n##########del post ############\r");
}
system("rm -f /tmp/post_data.txt");
sleep(1u);
v32 = fopen("/tmp/post_data.txt", "w");
if ( v32 )
{
fputs(v4, v32);
fclose(v32);
}
v33 = (const char *)&unk_F062B;
v34 = (char *)&v45;
}
else if ( !strcmp((const char *)&v53, "OPTIONS") )
{
v35 = fopen("/tmp/options_result", "r");
if ( v35 )
{
fclose(v35);
system("rm -f /tmp/options_result");
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
puts("\r\n##########del option ############\r");
}
v33 = (const char *)&unk_F06A2;
v34 = (char *)&v45;
}
else
{
v36 = fopen("/tmp/cgi_result", "r");
if ( v36 )
{
fclose(v36);
system("rm -f /tmp/cgi_result");
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
puts("\r\n##########delete /tmp/cgi_result ############\r");
}
v33 = (const char *)&unk_F070F;
v34 = (char *)&v45;
}
sprintf(v34, v33, &v50);
system((const char *)&v45);//key！！！
memset(&v49, 0, 0x40u);
memset(&v48, 0, 0x40u);
memset(&v51, 0, 0x20u);
memset(&v52, 0, 0x10u);
if ( acosNvramConfig_match((int)&unk_F0378, (int)"1") )
printf("\r\n###############%s(%d)\r\n", "netgear_commonCgi", 200);